As we approach the EOL, it's crucial to understand the current status of vulnerabilities in CentOS 7. The official docker container of CentOS 7 has 1 critical rated vulnerability, 13 high rated vulnerabilities, and 36 medium and low rated vulnerabilities. Even after installing all the available updates, we are still left with 2 highly rated and 17 medium and low vulnerabilities.
CentOS 7 has been a popular choice for many businesses and developers due to its stability, robustness, and compatibility with enterprise-level applications. According to W3Techs, CentOS is used by 2.8% of all the websites whose operating system is known. However, as announced on the official CentOS blog, the end of life (EOL) for CentOS 7 is fast approaching. This means that after June 30, 2024, CentOS 7 will no longer receive official support, updates, or security patches.
As we approach the EOL, it's crucial to understand the current status of vulnerabilities in CentOS 7.
The official docker container of CentOS 7 has 1 critical rated vulnerability, 13 high rated vulnerabilities, and 36 medium and low rated vulnerabilities. Even after installing all the available updates, we are still left with 2 highly rated and 17 medium and low vulnerabilities.
Docker scout Quickview centos7-updated:
Target │ centos7-updated:latest │ 0C 2H 3M 14L
digest │ 97fc48413665 │
Base image │ centos:7 │ 1C 13H 28M 12L
In a container with all the packages in the public repo installed, the risk of vulnerabilities is significantly higher. This is because each additional package increases the attack surface for potential threats.
In a VM, where there is a bootloader, kernel, etc., the risk of vulnerabilities is even higher. This is due to the increased complexity and the larger number of potential entry points for attackers.
Let's take an example of a vulnerability that could pose a risk. Suppose your application processes TIFF images using the popular libtiff library, even when installing the latest version available for CentOS 7 (4.0.3-35.el7), your application is affected by CVE-2022-48281. Alternatively, if the application running is based on Python 2.7, the server might be processing unauthenticated data due to CVE-2023-40217. Even though there are still about 8 months to the EOL, these vulnerabilities are not getting fixed. This could have serious compliance implications, especially for businesses in regulated industries.
Upgrading to a different distribution is not a straightforward task. It requires careful planning and execution. Google and RedHat have provided guides with proposed solutions. However, these solutions might not work for all applications.
For instance, a simple app that relies on specific features of CentOS 7 might break due to the upgrade. This is because different distributions might handle certain operations differently.
A tool to migrate to Rocky Linux is suggested by GCP. However, there are plenty of open issues, indicating that the tool is not fully reliable.
Seal Security recognizes the difficulties posed by the End of Life (EOL) of CentOS 7. Our solution offers standalone security patches for libraries available on CentOS through our public repository.
The EOL of CentOS 7 is a significant event that necessitates careful planning and preparation. By understanding the current status of vulnerabilities and the complexities involved in upgrading to a different distribution, you can make informed decisions to maintain the ongoing security and stability of your applications.
Reduce your organization's mean time to resolution, as well as limit your team's manual effort and technical debt. Respond quickly to challenges related to the CentOS EOL, as well as to other open source vulnerabilities with Seal Security.
